feat: hosted multi-user authsome server (v1)

[manojbajaj95]

Overview

Make authsome deployable as a shared server serving multiple users. Self-hostable via Docker; Authsome Inc. will also run a managed version with bundled OAuth app credentials.

Architecture decisions

• Identity: Hybrid DID — stable user identifier proven once via browser/OIDC, server issues a bearer token. Per-request AuthService with user identity injected from bearer token. See docs/UBIQUITOUS_LANGUAGE.md.
• Storage: Per-user LocalAppStore at /data/<user-id>/ for v1. Postgres backend deferred.
• ClientCredentials: ProviderClientRecord moves to server scope (server:<provider>:client), shared across all users. See docs/adr/0001-provider-client-record-server-scope.md.
• Hosted proxy: Option B (local sidecar + remote daemon via AUTHSOME_DAEMON_URL) already works. Option A (server-side mitmproxy) is deferred.

Sub-issues

• feat: identity/DID middleware — bearer token resolves to user identity per request #168 — Identity/DID middleware: bearer token → user identity, per-request AuthService
• feat: per-user storage partitioning for hosted deployment #169 — Per-user storage partitioning: LocalAppStore per user, fix AppStore.home: Path leak
• fix: move ProviderClientRecord to server scope (server:<provider>:client) #170 — ProviderClientRecord server scope: key schema change, drop profile field
• fix: enforce session ownership on auth session routes #171 — Session ownership enforcement: routes check session.profile == requesting_identity
• feat: hosted proxy — server-side mitmproxy (Option A) #172 — Hosted proxy Option A: server-side mitmproxy (roadmap, deferred)